CVE-2026-101077
CriticalCVSS 10.0Summary
A missing authentication vulnerability has been found in Netcore NR289-GE version 1.4.5102 in the function process_request of the boa_temp Handler component. The attack can be carried out remotely. The exploit is public, and the vendor did not respond.
Risk Assessment
Missing authentication may allow unauthorized users to access device functions, potentially leading to unauthorized configuration changes or other malicious activities.
Recommendation
Restrict access to the device from trusted networks, apply available firmware updates (if any), and monitor logs for suspicious activity. Contact the vendor for patches.
Other vulnerabilities in Netcore NR289-GE
See all- CVE-2026-101073High
A security flaw has been discovered in Netcore NR289-GE 1.4.5102. It affects an unknown function in the file /bin/boa of the CGI Dispatcher component. Manipulation results in improper authentication. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted but did not respond.
- CVE-2026-101076Critical
An OS command injection vulnerability has been detected in Netcore NR289-GE version 1.4.5102 in the system function of the file /set_ntp_server_ip.cgi (CGI Handler component). Manipulation of the argument ntp_ip allows remote command execution. The exploit is public, and the vendor did not respond.
- CVE-2026-101075Critical
An OS command injection vulnerability has been detected in Netcore NR289-GE version 1.4.5102 in the system function of the file /location_time.cgi (Location Time Handler component). Manipulation of the argument mac allows remote command execution. The exploit is public, and the vendor did not respond.
- CVE-2026-101074Critical
A stack-based buffer overflow vulnerability has been identified in Netcore NR289-GE version 1.4.5102 in the password-check function of the file /bin/boa (Authentication component). Manipulation of the argument Username allows remote attack. The exploit is public, and the vendor did not respond.
- CVE-2026-101072Critical
A vulnerability was identified in Netcore NR289-GE 1.4.5102 in the system function of the file /ap_ip.cgi of the CGI Handler component. Manipulation of the argument ip leads to OS command injection. The attack can be launched remotely, and the exploit is publicly available.
Original NVD description (English source)
A flaw has been found in Netcore NR289-GE 1.4.5102. This impacts the function process_request of the component boa_temp Handler. This manipulation causes missing authentication. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS